A flaw was found in the nvmet authentication flow of the Linux kernel. The kernel uses a host‑supplied size to allocate a response buffer, but the authentication builder only writes a fixed‑size payload. The trailing bytes of the buffer remain uninitialized and are copied to the initiator during the pre‑authentication handshake. This results in a remote initiator receiving arbitrary memory contents, effectively leaking kernel data and enabling potential information disclosure. The weakness is a classic case of sending uninitialized data to an external participant.

The vulnerability exists in the Linux kernel NVMe‑over‑TCP implementation. All kernel releases that include the pre‑fix nvmet‑auth code are affected; the fix is incorporated in the kernel at the commit referenced in the provided link. No specific product or version list is supplied, so any kernel running the vulnerable nvmet‑auth component is impacted.

The CVSS score is not provided, and the EPSS score is unavailable. KEV lists state that the vulnerability is not in the known exploited catalog. Although there is no published exploit, the bug can be triggered remotely by a malicious NVMe initiator that supplies a large allocation size; the uninitialized trailing bytes are then transmitted over the network. The lack of a public exploit and undefined CVSS suggest the threat level is moderate, but the possibility of leaking sensitive kernel memory warrants prompt remediation.